International Business Machines Corporation

Dov Murik

Fady Copty

Omri Soceanu

Sharon Keidar Barner

Ehud Aharoni

Lev Greenberg

Allon Adir

Tamer Salman

Ariel Farkash

Nitzan Peleg

Hayim Shaul

Ayman Jarrous

Cynthia Rae Eisner

Nir Drucker

Gilad Ezov

Omer Y Boehm

Akram Bitar

Ronen Levy

Evgeny Shindin

Orit Edelstein

Benjamin Zeltser

Matan Danos

Omer-Yehuda Boehm

A computer-implemented method comprising: generating, from a key-seed associated with a user, a set of homomorphic encryption (HE) keys associated with an HE scheme; receiving, from a key management system (KMS) associated with said HE scheme, an encrypted version of said key-seed; storing said encrypted version of said key-seed, and said set of HE keys, in an untrusted storage location; and at a decryption stage, decrypting an encrypted computation result generated using said HE scheme, by: (i) recalling, from said untrusted storage location, said encrypted version of said key-seed, (ii) providing said encrypted version of said key-seed to said KMS, to obtain a decrypted version of said key-seed s associated with said user, (iii) generating, from said received decrypted version of said key-seed, a secret HE key associated with said HE scheme, and (iv) using said secret HE key to decrypt said encrypted computation result.

Homomorphic encryption key management

An example system includes a processor that can obtain a circuit describing operations of sequential secure computation code. The processor can modify the circuit based on a cost function. The processor can partition the circuit into a number of sub-circuits. The processor can assign the number of the sub-circuits to different processors for execution.

Partitioning circuits for execution of sequential secure computation code on multiple processors

A method for automatically migrating infrastructure as code (IaC) from a first cloud infrastructure platform to a second cloud infrastructure platform is provided. The method may include receiving an original IaC comprising a first type of coding language. The method may further include using natural language processing to map a connection between the first type of coding language and a second type of coding language. The method may further include based on the mapped connection, using the NLP to automatically generate a partial translation of the first type of coding language to the second type of coding language. The method may further include using a machine learning algorithm to correct at least one inaccuracy in the partial translation. The method may further include generating a complete translation and implementing a second IaC on the second cloud infrastructure platform based on the complete translation.

Migrating infrastructure as code between different cloud providers

The present invention relates to novel techniques for monitoring changes to source code of Infrastructure as Code systems to detect attempted anomalous changes and block such changes from the code. For example, a method may comprise learning a security architecture and history of an infrastructure as code system to be deployed in at least one cloud account, monitoring changes to source code of the infrastructure as code system that are made before deployment of the infrastructure as code system to detect an anomaly, determining whether the detected anomaly affects regulated resources of the infrastructure as code system, and blocking changes to the source code of the infrastructure as code system that produce the detected anomaly that affects regulated resources of the infrastructure as code system.

User and entity behavior analytics of infrastructure as code in pre deployment of cloud infrastructure

An example system includes a processor to receive, at a setup or sign-up, a first cipher including a biometric template transformed using a first transformation and encrypted using a secret key, a second cipher including a security vector encrypted using the secret key, a third cipher including the biometric template transformed using a second transformation and encrypted, and a fourth cipher including an encrypted second security vector. The processor can receive, at a runtime or sign-in, a fifth cipher and a sixth cipher. The processor can verify that the fifth cipher includes a second biometric template transformed using the first transformation and encrypted using the secret key and that the sixth cipher includes the second biometric template transformed using the second transformation by testing a format attribute of the transformation functions using comparisons of inner products. The processor can authenticate a user based on the Euclidean distance between the first cipher and the sixth cipher not exceeding a threshold in response to detecting that the transformations are verified.

Authentication using transformation verification

Deriving malware signatures by training a binary decision tree using known malware and benign software samples, each tree node representing a different software feature set and having one descending edge representing samples that are characterized by the node's software feature set and another descending edge representing samples that are not characterized thusly, selecting multiple continuous descending paths for multiple subsets of nodes, each path traversing a selected one of the edges descending from each of the nodes in its corresponding subset, deriving, based on the nodes and edges in any of the paths, a malware-associated software feature signature where the malware samples represented by leaves that directly or indirectly descend from an end of the continuous descending path meets a minimum percentage of the total number of samples represented by the leaves, and providing the malware signatures for use by a computer-based security tool configured to identify malware.

Automatic malware signature generation for threat detection systems

An apparatus, a computer program product and a method for co-verification of systems comprising software and hardware components. The method comprises obtaining an over-approximation of the system that over-approximates the software or the hardware by using a non-deterministic version thereof; performing simulation of the over-approximation of the system; and utilizing an outcome of the simulation to guide a co-simulation of the system. The co-simulation comprises instrumenting the software to identify whether the coverage goals are reached during execution, generating a test input for the system, simulating execution of the test input by the instrumented software, wherein during said simulating, stimuli provided from the instrumented software to underlying hardware is provided to a hardware simulator that is configured to simulate the hardware-under-test; determining a coverage of the execution of the test input, and utilizing the coverage information in a successive iteration of the method.

Co-verification of hardware and software

A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

Compiler assisted protection against arbitrary code execution

A method, apparatus and product performing feature vector aggregation for malware detection. Two sets of measurements produced by a two dynamic analyses of an examined program are obtained, wherein the two dynamic analyses are performed with respect to the examined program executing two different execution paths. An aggregated feature vector representing the examined program is generated. The aggregated feature vector comprises a set of aggregated features, wherein a value of each aggregated feature is based on an aggregation of corresponding measurements in the first set of measurements and in the second set of measurements. A predictive model is applied on the aggregated feature vector to classify the examined program as malicious or benign.

Feature vector aggregation for malware detection

An apparatus, a computer program product and a method for hybrid genetic concolic co-verification of hardware and software. The method comprises repeatedly obtaining a test input for a system comprising a software and a hardware; performing a symbolic co-simulation of the system executing the test input to generate a symbolic co-simulation constraint and utilizing the symbolic co-simulation constraint to generate a new test input. The symbolic co-simulation comprises iteratively performing concolic execution of the software and symbolic simulation of the hardware. The concolic execution is guided using the test input and monitors software symbols. Iteratively performing the concolic execution and the symbolic simulation comprises collecting both software symbolic constraints over the software symbols and hardware symbolic constraints over at least a portion of the software symbols to generate the symbolic co-simulation constraint that comprises the software symbolic constraints and the hardware symbolic constraints.

Growing community of inventors

Haifa, Israel

Dov Murik